T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:48- Finding
Persistent Injection of Untrusted User Corrections into Future Agent Contexts
- Content
View full analysis
- Remediation
View remediation
Security audit
进化引擎免费版
Security checks for vulnerabilities and agentic risk
Overview
The skill is not clearly malicious, but it asks for unnecessary shell access and stores reusable memory across sessions without enough scoping controls.
Review carefully before installing. Use it only if you are comfortable with an agent saving local correction and reflection notes for later reuse, and avoid storing secrets or sensitive project details. Prefer a version that removes exec, clarifies or removes callback_url, scopes memory per project, and provides clear inspect/delete controls.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:16- Finding
Unnecessary Shell Execution Capability Violates Least Privilege
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Scope Creep
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Declaring exec despite the documented workflow only needing local file reads/writes violates least privilege. Unnecessary command execution capability expands the attack surface substantially, especially for an agent skill that persists and reuses natural-language instructions over time.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documented callback_url parameter implies sending completion data to an external endpoint, but the skill does not clearly disclose what data would be transmitted, when, or under whose control. Even if the current text also says no network requests are made, the presence of this parameter creates ambiguity that could mislead users about external data exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs persistent storage of user corrections and preferences on disk but does not prominently warn users that conversational content may be retained locally. This creates privacy and consent risks because users may reveal sensitive habits, preferences, or proprietary project details that are then stored and later resurfaced.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Persisting user corrections and preferences for later reinjection creates a natural-language retention channel that can store sensitive data and reintroduce it into future sessions. In a single-agent memory tool, this context makes the issue more credible because persistent recall is the core feature, so leakage or over-retention is not incidental but built into normal operation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Writing both user corrections and self-reflection logs to persistent files can accumulate sensitive conversational and project information over time, which may later be exposed through retrieval, prompt injection, or accidental sharing of the workspace. The skill context increases the risk because it encourages repeated retention after many tasks, making sensitive data buildup likely.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill claims it is pure Markdown and does not require exec capability, yet the manifest exposes exec. That mismatch can cause operators and users to underestimate the skill's effective privilege set, increasing the risk that a prompt-injection or misuse path invokes shell execution unexpectedly.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The visible name, summaries, description, and operational instructions are effectively constrained to Chinese, which may force a specific language experience without user opt-in. The file does not indicate that users can choose another language or that the locale restriction is intentional and justified.
- Content